The 'web-pop' package (version 2.3.5) is a malicious package designed to impersonate the legitimate 'pino' npm package. It contains a top-level immediately-invoked function expression (IIFE) in lib/initializeCaller.js that reconstructs a hardcoded remote URL by base64-decoding strings disguised as environment variables. This IIFE sends a POST request containing the entire process environment variables to the attacker's endpoint with a secret header. The response body is then executed as JavaScript code with full Node.js privileges, enabling arbitrary remote code execution and bulk exfiltration of sensitive environment data such as CI tokens, cloud keys, and credentials.

This malicious package allows attackers to exfiltrate sensitive environment variables including development tokens, cloud credentials, and other secrets. It also enables arbitrary remote code execution with full Node.js privileges on any machine that imports the package, potentially compromising the entire system and any connected resources.

No official patch or remediation is currently available. Users should immediately remove the 'web-pop' package version 2.3.5 from their projects and replace it with the legitimate 'pino' package. Avoid installing packages from untrusted sources or typosquatting variants. Monitor dependency manifests to prevent accidental inclusion of malicious packages.